{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,17]],"date-time":"2026-01-17T20:03:22Z","timestamp":1768680202465,"version":"3.49.0"},"reference-count":53,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2020,4,22]],"date-time":"2020-04-22T00:00:00Z","timestamp":1587513600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,4,22]],"date-time":"2020-04-22T00:00:00Z","timestamp":1587513600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100014180","name":"Junta de Castilla y Le\u00f3n","doi-asserted-by":"crossref","award":["LE045P17"],"award-info":[{"award-number":["LE045P17"]}],"id":[{"id":"10.13039\/501100014180","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Evolving Systems"],"published-print":{"date-parts":[[2021,3]]},"DOI":"10.1007\/s12530-020-09342-5","type":"journal-article","created":{"date-parts":[[2020,4,22]],"date-time":"2020-04-22T15:04:07Z","timestamp":1587567847000},"page":"79-90","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":11,"title":["Evaluation of feature learning for anomaly detection in network traffic"],"prefix":"10.1007","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2173-3364","authenticated-orcid":false,"given":"Daniel","family":"P\u00e9rez","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3467-4938","authenticated-orcid":false,"given":"Seraf\u00edn","family":"Alonso","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2762-6949","authenticated-orcid":false,"given":"Antonio","family":"Mor\u00e1n","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1563-1556","authenticated-orcid":false,"given":"Miguel A.","family":"Prada","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9023-0341","authenticated-orcid":false,"given":"Juan Jos\u00e9","family":"Fuertes","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3921-1599","authenticated-orcid":false,"given":"Manuel","family":"Dom\u00ednguez","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2020,4,22]]},"reference":[{"key":"9342_CR1","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1016\/j.jnca.2015.11.016","volume":"60","author":"M Ahmed","year":"2016","unstructured":"Ahmed M, Mahmood AN, Hu J (2016) A survey of network anomaly detection techniques. J Netw Comput Appl 60:19\u201331","journal-title":"J Netw Comput Appl"},{"issue":"10","key":"9342_CR2","doi-asserted-by":"publisher","first-page":"2986","DOI":"10.1109\/TC.2016.2519914","volume":"65","author":"MA Ambusaidi","year":"2016","unstructured":"Ambusaidi MA, He X, Nanda P, Tan Z (2016) Building an intrusion detection system using a filter-based feature selection algorithm. IEEE Trans Comput 65(10):2986\u20132998","journal-title":"IEEE Trans Comput"},{"key":"9342_CR3","doi-asserted-by":"publisher","unstructured":"Angelov P (2014) Anomaly detection based on eccentricity analysis. In: 2014 IEEE Symposium on Evolving and Autonomous Learning Systems (EALS), pp 1\u20138, https:\/\/doi.org\/10.1109\/EALS.2014.7009497","DOI":"10.1109\/EALS.2014.7009497"},{"key":"9342_CR4","first-page":"157","volume-title":"Anomaly detection-empirical approach","author":"PP Angelov","year":"2019","unstructured":"Angelov PP, Gu X (2019) Anomaly detection-empirical approach. Springer International Publishing, Cham, pp 157\u2013173"},{"issue":"8","key":"9342_CR5","doi-asserted-by":"publisher","first-page":"1798","DOI":"10.1109\/TPAMI.2013.50","volume":"35","author":"Y Bengio","year":"2013","unstructured":"Bengio Y, Courville A, Vincent P (2013) Representation learning: a review and new perspectives. IEEE Trans Pattern Anal Mach Intell 35(8):1798\u20131828","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"issue":"1","key":"9342_CR6","doi-asserted-by":"publisher","first-page":"303","DOI":"10.1109\/SURV.2013.052213.00046","volume":"16","author":"MH Bhuyan","year":"2014","unstructured":"Bhuyan MH, Bhattacharyya DK, Kalita JK (2014) Network anomaly detection: methods, systems and tools. IEEE Commun Surv Tutor 16(1):303\u2013336","journal-title":"IEEE Commun Surv Tutor"},{"key":"9342_CR7","doi-asserted-by":"publisher","first-page":"93","DOI":"10.1145\/335191.335388","volume":"29","author":"MM Breunig","year":"2000","unstructured":"Breunig MM, Kriegel HP, Ng RT, Sander J (2000) LOF: identifying density-based local outliers. ACM Sigmod Record ACM 29:93\u2013104","journal-title":"ACM Sigmod Record ACM"},{"issue":"2","key":"9342_CR8","doi-asserted-by":"publisher","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","volume":"18","author":"AL Buczak","year":"2015","unstructured":"Buczak AL, Guven E (2015) A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun Surv Tutor 18(2):1153\u20131176","journal-title":"IEEE Commun Surv Tutor"},{"issue":"3","key":"9342_CR9","doi-asserted-by":"publisher","first-page":"15:1","DOI":"10.1145\/1541880.1541882","volume":"41","author":"V Chandola","year":"2009","unstructured":"Chandola V, Banerjee A, Kumar V (2009) Anomaly detection\u2014a survey. ACM Comput Surv 41(3):15:1\u201315:44. https:\/\/doi.org\/10.1145\/1541880.1541882","journal-title":"ACM Comput Surv"},{"key":"9342_CR10","doi-asserted-by":"crossref","unstructured":"Chen Y, Li Y, Cheng XQ, Guo L (2006) Survey and taxonomy of feature selection algorithms in intrusion detection system. In: International conference on information security and cryptology, Springer, New York, pp 153\u2013167","DOI":"10.1007\/11937807_13"},{"key":"9342_CR11","doi-asserted-by":"publisher","first-page":"121","DOI":"10.1016\/j.patcog.2016.03.028","volume":"58","author":"SM Erfani","year":"2016","unstructured":"Erfani SM, Rajasegarar S, Karunasekera S, Leckie C (2016) High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning. Pattern Recognit 58:121\u2013134","journal-title":"Pattern Recognit"},{"issue":"1","key":"9342_CR12","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","volume":"28","author":"P Garcia-Teodoro","year":"2009","unstructured":"Garcia-Teodoro P, Diaz-Verdejo J, Maci\u00e1-Fern\u00e1ndez G, V\u00e1zquez E (2009) Anomaly-based network intrusion detection: techniques, systems and challenges. Comput Secur 28(1):18\u201328","journal-title":"Comput Secur"},{"issue":"4","key":"9342_CR13","doi-asserted-by":"publisher","first-page":"2479","DOI":"10.3233\/JIFS-171947","volume":"34","author":"CN Giap","year":"2018","unstructured":"Giap CN, Son LH, Chiclana F (2018) Dynamic structural neural network. J Intell Fuzzy Syst 34(4):2479\u20132490","journal-title":"J Intell Fuzzy Syst"},{"key":"9342_CR14","unstructured":"Goldstein M, Dengel A (2012) Histogram-based outlier score (HBOS): A fast unsupervised anomaly detection algorithm. In: W\u00f6lfl S (ed) Poster and Demo Track of the 35th German Conference on Artificial Intelligence (KI-2012), pp 59\u201363"},{"key":"9342_CR15","volume-title":"Deep learning","author":"I Goodfellow","year":"2016","unstructured":"Goodfellow I, Bengio Y, Courville A, Bengio Y (2016) Deep learning, vol 1. MIT press, Cambridge"},{"key":"9342_CR16","doi-asserted-by":"publisher","unstructured":"Gu X, Angelov P (2017) Autonomous anomaly detection. In: 2017 evolving and adaptive intelligent systems (EAIS), pp 1\u20138, https:\/\/doi.org\/10.1109\/EAIS.2017.7954831","DOI":"10.1109\/EAIS.2017.7954831"},{"issue":"1","key":"9342_CR17","first-page":"1157","volume":"3","author":"I Guyon","year":"2003","unstructured":"Guyon I, Elisseeff A (2003) An introduction to variable and feature selection. J Mach Learn Res 3(1):1157\u20131182","journal-title":"J Mach Learn Res"},{"issue":"5786","key":"9342_CR18","doi-asserted-by":"publisher","first-page":"504","DOI":"10.1126\/science.1127647","volume":"313","author":"GE Hinton","year":"2006","unstructured":"Hinton GE, Salakhutdinov RR (2006) Reducing the dimensionality of data with neural networks. Science 313(5786):504\u2013507. https:\/\/doi.org\/10.1126\/science.1127647","journal-title":"Science"},{"issue":"3","key":"9342_CR19","doi-asserted-by":"publisher","first-page":"264","DOI":"10.1145\/331499.331504","volume":"31","author":"AK Jain","year":"1999","unstructured":"Jain AK, Murty MN, Flynn PJ (1999) Data clustering: a review. ACM Comput Surv (CSUR) 31(3):264\u2013323","journal-title":"ACM Comput Surv (CSUR)"},{"key":"9342_CR20","doi-asserted-by":"crossref","unstructured":"Javaid A, Niyaz Q, Sun W, Alam M (2016) A deep learning approach for network intrusion detection system. In: Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS), ICST, pp 21\u201326","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"9342_CR21","volume-title":"Principal component analysis","author":"I Jolliffe","year":"2011","unstructured":"Jolliffe I (2011) Principal component analysis. Springer, New York"},{"key":"9342_CR22","doi-asserted-by":"publisher","first-page":"255","DOI":"10.1016\/j.cose.2017.06.005","volume":"70","author":"C Khammassi","year":"2017","unstructured":"Khammassi C, Krichen S (2017) A GA-LR wrapper approach for feature selection in network intrusion detection. Comput Secur 70:255\u2013277","journal-title":"Comput Secur"},{"issue":"4","key":"9342_CR23","doi-asserted-by":"publisher","first-page":"507","DOI":"10.1007\/s00778-006-0002-5","volume":"16","author":"L Khan","year":"2007","unstructured":"Khan L, Awad M, Thuraisingham B (2007) A new intrusion detection system using support vector machines and hierarchical clustering. VLDB J 16(4):507\u2013521","journal-title":"VLDB J"},{"key":"9342_CR24","unstructured":"Kingma DP, Ba J (2014) Adam: A method for stochastic optimization. CoRR abs\/1412.6980,"},{"key":"9342_CR25","unstructured":"Kingma DP, Welling M (2013) Auto-encoding variational bayes. arXiv preprint arXiv:13126114"},{"key":"9342_CR26","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-39351-3","volume-title":"Nonlinear dimensionality reduction","author":"JA Lee","year":"2007","unstructured":"Lee JA, Verleysen M (2007) Nonlinear dimensionality reduction. Springer Science & Business Media, New York"},{"key":"9342_CR27","doi-asserted-by":"crossref","unstructured":"Liu FT, Ting KM, hua Zhou Z (2008) Isolation forest. In: In ICDM \u201908: Proceedings of the 2008 Eighth IEEE International Conference on Data Mining. IEEE Computer Society, pp 413\u2013422","DOI":"10.1109\/ICDM.2008.17"},{"key":"9342_CR28","first-page":"2579","volume":"9","author":"Maaten Lvd","year":"2008","unstructured":"Lvd Maaten, Hinton G (2008) Visualizing data using t-SNE. J Mach Learn Res 9:2579\u20132605","journal-title":"J Mach Learn Res"},{"key":"9342_CR29","doi-asserted-by":"crossref","unstructured":"Madhawa S, Balakrishnan P, Arumugam U (2018) Employing invariants for anomaly detection in software defined networking based industrial internet of things. J Intell Fuzzy Syst (Preprint):1\u201313","DOI":"10.3233\/JIFS-169670"},{"key":"9342_CR30","unstructured":"Mahoney MV, Chan PK (2003) An analysis of the 1999 DARPA\/Lincoln laboratory evaluation data for network anomaly detection. In: International Workshop on Recent Advances in Intrusion Detection, Springer, New York, pp 220\u2013237"},{"key":"9342_CR31","doi-asserted-by":"publisher","first-page":"59657","DOI":"10.1109\/ACCESS.2018.2875045","volume":"6","author":"N Marir","year":"2018","unstructured":"Marir N, Wang H, Feng G, Li B, Jia M (2018) Distributed abnormal behavior detection approach based on deep belief network and ensemble svm using spark. IEEE Access 6:59657\u201359671","journal-title":"IEEE Access"},{"key":"9342_CR32","doi-asserted-by":"crossref","unstructured":"Martins RS, Angelov P, Sielly Jales Costa B (2018) Automatic detection of computer network traffic anomalies based on eccentricity analysis. In: 2018 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), pp 1\u20138, 10.1109\/FUZZ-IEEE.2018.8491507","DOI":"10.1109\/FUZZ-IEEE.2018.8491507"},{"issue":"4","key":"9342_CR33","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1145\/382912.382923","volume":"3","author":"J McHugh","year":"2000","unstructured":"McHugh J (2000) Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln laboratory. ACM Trans Inf Syst Secur (TISSEC) 3(4):262\u2013294","journal-title":"ACM Trans Inf Syst Secur (TISSEC)"},{"key":"9342_CR34","doi-asserted-by":"crossref","unstructured":"Mirsky Y, Doitshman T, Elovici Y, Shabtai A (2018) Kitsune: an ensemble of autoencoders for online network intrusion detection. arXiv preprint arXiv:180209089","DOI":"10.14722\/ndss.2018.23204"},{"key":"9342_CR35","doi-asserted-by":"crossref","unstructured":"Moustafa N, Slay J (2015) UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: Military Communications and Information Systems Conference (MilCIS), 2015, IEEE, pp 1\u20136","DOI":"10.1109\/MilCIS.2015.7348942"},{"issue":"3","key":"9342_CR36","doi-asserted-by":"publisher","first-page":"648","DOI":"10.3923\/itj.2011.648.655","volume":"10","author":"Z Muda","year":"2011","unstructured":"Muda Z, Yassin W, Sulaiman M, Udzir NI et al (2011) A k-means and naive bayes learning approach for better intrusion detection. Inf Technol J 10(3):648\u2013655","journal-title":"Inf Technol J"},{"key":"9342_CR37","unstructured":"Nguyen MN, Vien NA (2018) Scalable and interpretable one-class SVMs with deep learning and random fourier features. arXiv preprint arXiv:180404888"},{"key":"9342_CR38","first-page":"2825","volume":"12","author":"F Pedregosa","year":"2011","unstructured":"Pedregosa F, Varoquaux G, Gramfort A, Michel V, Thirion B, Grisel O, Blondel M, Prettenhofer P, Weiss R, Dubourg V et al (2011) Scikit-learn: machine learning in python. J Mach Learn Res 12:2825\u20132830","journal-title":"J Mach Learn Res"},{"key":"9342_CR39","doi-asserted-by":"crossref","unstructured":"P\u00e9rez D, Alonso S, Mor\u00e1n A, Prada MA, Fuertes JJ, Dom\u00ednguez M (2019) Comparison of network intrusion detection performance using feature representation. In: Macintyre J, Iliadis L, Maglogiannis I, C J (eds) International Conference on Engineering Applications of Neural Networks. Communications in Computer and Information Science, vol. 1000, Springer, pp 463\u2013475","DOI":"10.1007\/978-3-030-20257-6_40"},{"key":"9342_CR40","unstructured":"Rezende DJ, Mohamed S, Wierstra D (2014) Stochastic backpropagation and approximate inference in deep generative models. arXiv preprint arXiv:14014082"},{"key":"9342_CR41","doi-asserted-by":"publisher","first-page":"147","DOI":"10.1016\/j.cose.2019.06.005","volume":"86","author":"M Ring","year":"2019","unstructured":"Ring M, Wunderlich S, Scheuring D, Landes D, Hotho A (2019) A survey of network-based intrusion detection data sets. Comput Secur 86:147\u2013167","journal-title":"Comput Secur"},{"key":"9342_CR42","doi-asserted-by":"publisher","first-page":"109","DOI":"10.1145\/1269899.1254895","volume":"35","author":"H Ringberg","year":"2007","unstructured":"Ringberg H, Soule A, Rexford J, Diot C (2007) Sensitivity of PCA for traffic anomaly detection. ACM SIGMETRICS Perform Eval Rev ACM 35:109\u2013120","journal-title":"ACM SIGMETRICS Perform Eval Rev ACM"},{"issue":"3","key":"9342_CR43","doi-asserted-by":"publisher","first-page":"212","DOI":"10.1080\/00401706.1999.10485670","volume":"41","author":"PJ Rousseeuw","year":"1999","unstructured":"Rousseeuw PJ, Driessen KV (1999) A fast algorithm for the minimum covariance determinant estimator. Technometrics 41(3):212\u2013223","journal-title":"Technometrics"},{"key":"9342_CR44","doi-asserted-by":"publisher","first-page":"4033","DOI":"10.3233\/JIFS-190207","volume":"37","author":"JdJ Rubio","year":"2019","unstructured":"Rubio JdJ, Cruz D, Elias Barr\u00f3n I, Ochoa G, Balcazarand R, Aguilar A (2019) ANFIS system for classification of brain signals. J Intell Fuzzy Syst 37:4033\u20134041. https:\/\/doi.org\/10.3233\/JIFS-190207","journal-title":"J Intell Fuzzy Syst"},{"issue":"7","key":"9342_CR45","doi-asserted-by":"publisher","first-page":"1443","DOI":"10.1162\/089976601750264965","volume":"13","author":"B Sch\u00f6lkopf","year":"2001","unstructured":"Sch\u00f6lkopf B, Platt JC, Shawe-Taylor J, Smola AJ, Williamson RC (2001) Estimating the support of a high-dimensional distribution. Neural Comput 13(7):1443\u20131471","journal-title":"Neural Comput"},{"key":"9342_CR46","doi-asserted-by":"crossref","unstructured":"Sharafaldin I, Lashkari AH, Ghorbani AA (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: ICISSP, pp 108\u2013116","DOI":"10.5220\/0006639801080116"},{"key":"9342_CR47","doi-asserted-by":"crossref","unstructured":"Sommer R, Paxson V (2010) Outside the closed world: On using machine learning for network intrusion detection. In: 2010 IEEE symposium on security and privacy, IEEE, pp 305\u2013316","DOI":"10.1109\/SP.2010.25"},{"key":"9342_CR48","doi-asserted-by":"crossref","unstructured":"Song J, Takakura H, Okabe Y, Eto M, Inoue D, Nakao K (2011) Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation. In: Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, ACM, pp 29\u201336","DOI":"10.1145\/1978672.1978676"},{"key":"9342_CR49","doi-asserted-by":"crossref","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani AA (2009) A detailed analysis of the KDD CUP 99 data set. In: Proceedings of the Second IEEE Symposium on Computational Intelligence for Security and Defence Applications 2009","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"9342_CR50","doi-asserted-by":"publisher","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","volume":"7","author":"R Vinayakumar","year":"2019","unstructured":"Vinayakumar R, Alazab M, Soman K, Poornachandran P, Al-Nemrat A, Venkatraman S (2019) Deep learning approach for intelligent intrusion detection system. IEEE Access 7:41525\u201341550","journal-title":"IEEE Access"},{"key":"9342_CR51","doi-asserted-by":"crossref","unstructured":"Wang K, Stolfo SJ (2004) Anomalous payload-based network intrusion detection. In: International Workshop on Recent Advances in Intrusion Detection, Springer, pp 203\u2013222","DOI":"10.1007\/978-3-540-30143-1_11"},{"key":"9342_CR52","doi-asserted-by":"crossref","unstructured":"Yousefi-Azar M, Varadharajan V, Hamey L, Tupakula U (2017) Autoencoder-based feature learning for cyber security applications. In: 2017 International joint conference on neural networks (IJCNN), IEEE, pp 3854\u20133861","DOI":"10.1109\/IJCNN.2017.7966342"},{"key":"9342_CR53","unstructured":"Zhang Z, Li J, Manikopoulos C, Jorgenson J, Ucles J (2001) HIDE: a hierarchical network intrusion detection system using statistical preprocessing and neural network classification. In: Proc. IEEE Workshop on Information Assurance and Security, pp 85\u201390"}],"container-title":["Evolving Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12530-020-09342-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s12530-020-09342-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12530-020-09342-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,4,22]],"date-time":"2021-04-22T00:52:30Z","timestamp":1619052750000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s12530-020-09342-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,4,22]]},"references-count":53,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2021,3]]}},"alternative-id":["9342"],"URL":"https:\/\/doi.org\/10.1007\/s12530-020-09342-5","relation":{},"ISSN":["1868-6478","1868-6486"],"issn-type":[{"value":"1868-6478","type":"print"},{"value":"1868-6486","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,4,22]]},"assertion":[{"value":"30 September 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"31 March 2020","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 April 2020","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}